build: drop unused agent-image apt deps

Removes socat, openssh-client, and dnsutils from Dockerfile.claude
and Dockerfile.codex.

- socat was the privileged forwarder for the in-container ssh-agent
  that PRD 0009 removed; nothing in bot_bottle references it.
- openssh-client was needed back when the agent talked ssh:// to
  upstreams; git-gate's insteadOf rewrites now route every upstream
  through HTTP/git-protocol, and ssh-keygen runs host-side from the
  deploy-key provisioner.
- dnsutils was only used by tests/integration/test_sandbox_escape.py
  (attack 4b runs dig from inside the agent container).

Splits python3/python3-pip/python3-venv onto a separate layer with
a comment noting they're app-specific and a candidate to move to a
downstream image.

bot_bottle/egress_addon.py

@@ -82,14 +82,6 @@ class EgressAddon:
             {"Content-Type": "text/plain; charset=utf-8"},
         )
 
-    def _block(self, flow: http.HTTPFlow, reason: str) -> None:
-        sys.stderr.write(f"{reason}\n")
-        flow.response = http.Response.make(
-            403,
-            reason.encode("utf-8"),
-            {"Content-Type": "text/plain; charset=utf-8"},
-        )
-
     def request(self, flow: http.HTTPFlow) -> None:
         request_path, _, query = flow.request.path.partition("?")
 
@@ -108,18 +100,25 @@ class EgressAddon:
                 scan_text = auth_header + "\n" + body
             dlp_result = scan_outbound(route, scan_text, os.environ)
             if dlp_result is not None and dlp_result.severity == "block":
-                self._block(flow, f"egress DLP: {dlp_result.reason}")
+                flow.response = http.Response.make(
+                    403,
+                    f"egress DLP: {dlp_result.reason}".encode("utf-8"),
+                    {"Content-Type": "text/plain; charset=utf-8"},
+                )
                 return
 
         # Strip inbound Authorization — agent cannot smuggle tokens.
         flow.request.headers.pop("authorization", None)
 
         if is_git_push_request(request_path, query):
-            self._block(
+            flow.response = http.Response.make(
-                flow,
+                403,
-                "egress: git push over HTTPS is not supported; "
+                (
-                "use the bottle.git SSH path (gitleaks-scanned by "
+                    b"egress: git push over HTTPS is not supported; "
-                "git-gate's pre-receive hook).",
+                    b"use the bottle.git SSH path (gitleaks-scanned by "
+                    b"git-gate's pre-receive hook)."
+                ),
+                {"Content-Type": "text/plain; charset=utf-8"},
             )
             return
 
@@ -136,7 +135,11 @@ class EgressAddon:
         )
 
         if decision.action == "block":
-            self._block(flow, decision.reason)
+            flow.response = http.Response.make(
+                403,
+                decision.reason.encode("utf-8"),
+                {"Content-Type": "text/plain; charset=utf-8"},
+            )
             return
 
         if decision.inject_authorization is not None:
@@ -156,7 +159,11 @@ class EgressAddon:
         if result is None:
             return
         if result.severity == "block":
-            self._block(flow, f"egress DLP: {result.reason}")
+            flow.response = http.Response.make(
+                403,
+                f"egress DLP: {result.reason}".encode("utf-8"),
+                {"Content-Type": "text/plain; charset=utf-8"},
+            )
         elif result.severity == "warn":
             sys.stderr.write(f"egress DLP warn: {result.reason}\n")